Michael D. Schleif wrote: > Jeff Newmiller wrote:
Jeff I'm sorry you ended up with that reply. Please don't take it home with you, so to speak. We highly value your contributions to LEAF, and we appreciate your willingness to help Michael. >>On Fri, 8 Mar 2002, Michael D. Schleif wrote: >> >> >>>We are seeing martians on internal networks on a regular basis. >>> >>>Usually, it is traceable to users logging into AOL over our high speed >>>internet connections: >>> >>> 172.128.0.0 - 172.191.255.255 >>> >>>Today, we saw one from United Airlines: >>> >>> 205.174.16.0 - 205.174.23.255 >>> >>>[1] How does this happen? If that's all there was to the original post, I'm surprised Jeff even responded. In case you haven't been reading leaf-devel lately, we've been rehashing out the "Howto request help" document that clearly states what will help us help you. You chose to ignore it twice in a row. Fine. >>I often wonder how it happens that people who should know better fail to >>provide specific error and log messages and explain what they know about >>the particulars of the ip addresses, routes, machines and connections >>involved. It is hard to trust reports as sanitized as this. >> > > Jeff, I respect your intelligence and firewall skills; however, if you > read exactly what I posted, then you will know exactly what there is to > know. "You will know exactly what there is to know" ? Oh my God, Michael. This is a technical list for a science project. This is not metaphysics. Quantify. Don't qualify. >>On the surface, the idea that packets should be generated within your LAN >>with source addresses outside your network would suggest something is >>seriously broken (accidentally or purposefully) with the workstation >>generating the packets. >> > > That is one idea, isn't it? What purpose does your question serve? I can't fathom that you want an answer to it. In addition, you have proffered it to one of our most experienced, knowledgable, dedicated, and accurate members. You'll find it difficult to persue a worse course of action. >>>[2] Why does this happen? >>> >>Speculation: if your AOL users are actually dialling into AOL while being >>on the network, they may be temporarily acquiring an IP from AOL, and >>Windows could possibly screw up and ships packets out the wrong interface. >>However, something would have to be pretty weird with the AOL software if >>it decided it had an AOL IP even if no dialup had occurred. There could >>possibly be overlap when a dialup connection was lost as well. >> > > Please, please, please, read my post and respond accordingly: > > `` ... users logging into AOL over our high speed internet connections > ... '' > > They are *NOT* _dialing_ into AOL !!! Yes, ok we can see that. Please excuse Jeff if he's unclear on your setup. He stated he was unclear and asked for the usual details that are laid out in the FAQ. You ignored that request and instead followup with yelling in CAPS, numerous exclamtion points, redundant "pleases" all in a chiding, demeaning tone. That's uncalled for. God forbid you should explain what the heck "our high speed internet connections" in plural refers to or any real details of your network. > Or, even if they were, the questions remain the same -- what's the > difference? > > > > >>>[3] Is this exploitable? >>> >>Insufficient data. >> > > How much data will suffice? How many times do we have to repeat ourselves? Use the Troubleshooting FAQ. Post what it says to post plus any other details you think would help. I don't think that's so difficult. I don't think that's too much to ask. > A smattering of log entries: > > Feb 26 08:17:36 redtrout kernel: martian source 0b49a2ac for ffffffff, > dev eth1 > Feb 26 08:21:11 redtrout kernel: martian source 490b99ac for ffffffff, > dev eth1 [snip] > For those who cannot be bothered to find their hex calculators: What? Are you serious? For the love of Pete. > 0.0.234.239 efea0000 > 12.248.73.21 1549f80c > 24.147.110.151 976e9318 [snip] > What more do you need? Nothing more on this thread, ever. I'm going to chalk this one up to "something got lost in the translation" from Michael's native language to English. Take it easy, Jeff. Matthew _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
